LFG Labs AG · Security research
Help us find security failures.
We offer paid rewards for original, reproducible vulnerabilities in the LFG-maintained software listed below. Submit a safe reproduction and explain the security property that fails.
Effective date: 7 April 2025. These terms have been in effect since that date.
Eligible targets
- Verity: the default branch at the time of your report. Eligible findings include compiler correctness failures, unsound verification results, and security-relevant mismatches between specified and generated contract behavior.
- SafeLens: the default branch at the time of your report. Eligible findings include acceptance of invalid transaction evidence, incorrect security-relevant transaction decoding, or bypass of offline verification guarantees.
Include the exact commit hash and affected component. Testing is authorized only on your local copies and isolated local EVM forks with synthetic assets. Client contracts, live deployments, websites, APIs, infrastructure, third-party dependencies and all other repositories are outside this program. Starknet ID is not included in this version; its deployments require a separate explicit scope.
Coordinate before starting
To avoid wasted effort on issues that are already reported, known, or under active remediation, contact us before starting your research. Email thomas@lfglabs.dev, copying ben@lfglabs.dev, with the repository, commit or module, and security properties you plan to examine so we can confirm what is in scope and whether the area is already covered.
Rewards
| Severity | USD reward | Illustrative impact |
|---|---|---|
| Critical | $2,500–$5,000 | Direct compromise of an in-scope security guarantee with a reproducible path to loss of funds or unauthorized transaction approval. |
| High | $1,000–$2,500 | A substantial authorization bypass or verification failure requiring specific preconditions. |
| Medium | $250–$1,000 | A limited security-property violation with demonstrated practical impact. |
| Low | $100–$250 | A reproducible security weakness with limited impact. |
LFG Labs determines severity and the final award within the applicable range from demonstrated impact, exploit preconditions and reproduction quality. Multiple symptoms of one root cause receive one award. The first complete eligible report receives the reward; duplicates and already documented issues are not eligible. The maximum award per root cause is $5,000.
Rewards are denominated in USD. After validation, we agree a lawful payment method with the researcher and aim to pay within 30 days of accepting the award. Researchers must be legally eligible to receive payment; any necessary payment or compliance information is requested through an agreed private channel. Employees and contributors reporting issues arising from their own paid work for LFG are not eligible.
Safe testing rules
- Use local test environments and accounts, data and assets you control. Do not test against mainnet, public testnets or production services.
- Do not access other people’s data, move real funds, disrupt services, conduct social engineering or phishing, install malware, or attack third parties.
- Use the smallest proof of concept needed to demonstrate the failure. Stop if you encounter secrets, personal information or effects outside the scope.
- Keep the finding confidential while we assess and remediate it. Coordinate disclosure timing with us; report any accidental exposure promptly.
Submit a report
Email thomas@lfglabs.dev, copying ben@lfglabs.dev, with “Bug bounty” in the subject. Include the repository and commit, affected property, expected and observed behavior, prerequisites, safe reproduction steps and impact. Ask for a private transfer channel before sending sensitive exploit material; never send production credentials or personal data.
We aim to acknowledge reports within three business days and provide an initial assessment within ten business days. Complex findings may need additional time; we will communicate progress and coordinate remediation and disclosure with you.
Program boundaries
We will not pursue action against good-faith research conducted within these testing rules. This commitment applies to LFG Labs only and cannot bind third parties. Changes to these terms apply prospectively; eligible reports received while a version is effective are assessed under that version.
Security contacts and engagement boundaries · Our security assessment work